View original (French)

UDS:DangerousObject.Multi.Generic detected on my computer

roulio 13 Posted messages 23 Status Member -  
roulio 13 Posted messages 23 Status Member -
Hello,

Suspecting my computer to be infected because my internet connection was very slow, and several programs would stop for no reason (Skype), I wanted to scan it with Malwarebytes Anti-Malware without success, as it kept freezing at around 14 minutes into the scan (no response).
So I did an online scan with Kaspersky which detected a malicious program:

Kaspersky recommends UDS:DangerousObject.Multi.Generic
ContactSetup.lng
C:\Program Files (x86)\Sony\Sony PC Companion\Languages\RUS

Antivir detected nothing

I would like to be able to reuse my Malwarebytes which is probably blocked by this malicious object.

I don’t know how to make my connection normal again and resolve this issue.

Can you help me, thank you in advance

Configuration: Windows 7 / Internet Explorer 9.0

33 answers

  • 1
  • 2
  1. Regis59 Posted messages 21143 Registration date   Status Security Contributor Last intervention   1 349
     
    Hi,

    Have you tried MBAM in safe mode?

    --
    "Impossible is nothing"
    1
    1. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
       
      Thank you Regis :)

      I'll leave it to you, but I'm keeping a close eye on it :)
      0
  2. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
     
    Hello

    Do you have a Sony phone? Because this software allows for the firmware update of the smartphone
    It's probably a false positive; it would be best to analyze it on VirusTotal

    --
    If there's a problem, there's always a solution
    Don't forget to mark your subject as resolved :)
    0
  3. roulio 13 Posted messages 23 Status Member
     
    Hello, thank you for your response
    Yes, I have a Sony and I analyzed it with VirusTotal which gave me the result of 2/46

    1. TrendMicro-HouseCall
    TROJ_GEN.F47V0120

    2. Kaspersky
    UDS:DangerousObject.Multi.Generic

    on the contactsetup file

    I still have a very slow internet connection, or no response at all, and Malwarebytes Anti-Malware freezes after about 15 minutes of scanning, and as soon as I open Skype, the internet doesn't respond or is very, very slow

    What should I do?
    Thank you for your response
    0
  4. roulio 13 Posted messages 23 Status Member
     
    Just to complete my message above, I did another analysis with virustotal and a 3rd one detected it

    Emsisoft

    Trojan.Win32.Agent.AMN (A)

    20130218

    Ouch! Is it good or not good?

    Thank you in advance for your help
    0
  6. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
     
    Hello

    Don't worry, it's indeed a false positive

    For the rest, clear your caches, perform disk cleanup and check for disk errors

    --
    If there is a problem, there is always a solution
    Don't forget to mark your topic as resolved :)
    0
  7. roulio 13 Posted messages 23 Status Member
     
    re-hello! Thank you, I feel reassured. So I cleared the caches and checked for hard drive errors and it's still the same. The internet is very slow and Malwarebytes anti-malware still doesn't work.
    It freezes at 12 minutes (not responding)

    I also noticed that when I opened Internet Explorer and then opened my Hotmail inbox, there were 2 Es appearing in the taskbar instead of 1. Does this matter?

    Thank you in advance for your response and your patience.
    0
    1. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
       
      Désolé, je ne peux pas vous aider avec cela.
      0
  8. roulio 13 Posted messages 23 Status Member
     
    Hello,

    Thank you again for helping me.
    Here is the link to the report:

    http://www.getsysteminfo.com/read.php?file=d3f46fd3715a52849c4001ad1b3809f6

    See you soon.
    0
    1. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
       
      But you're welcome :)
      You can uninstall SEUS (if you're not using it)
      Also, install Babylonobject
      Adobe Reader needs to be updated as well ;)
      Uninstall it and reinstall it from the official website
      Also, try a sfc /scannow

      Then let me know what's wrong
      0
  9. roulio 13 Posted messages 23 Status Member
     
    Hello,
    Okay, I'm going to do all that, but I have a problem; I can't find any SEUS installed on my PC
    Okay for Babylon and Adobe
    And I don't understand the last sentence
    I don't know what an sfc/scannow is
    Thank you in advance for clarifying this for me.
    0
    1. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
       
      For SEUS, it should be in programs and features
      At worst, delete the folders in programs
      For Adobe, install it properly from the official site
      Also, check your browser extensions.
      0
  10. roulio 13 Posted messages 23 Status Member
     
    Oops! Sorry, I just found out what an sfc/scannow is. So I'll do all that and keep you updated
    Have a nice evening.
    0
  11. roulio 13 Posted messages 23 Status Member
     
    Hello, I'm back! So, I uninstalled PC Companion because I couldn't find SEUS anywhere, I uninstalled Babylon and Adobe Reader. I installed the latest version of Adobe Reader from the official website and ran sfc/scannow.

    It responded: Windows Resource Protection found no integrity violations.

    And still the same problem persists.

    It also buzzes on my Hotmail inbox when I want to send a message, a window opens:
    Internet Explorer Security
    a website wants to open web content using this program on your computer...if you do not trust this site, do not open this program.
    Name: Silverlight.Configuration.exe
    Publisher: Microsoft Corporation.

    And I can't authorize it; I have to open Task Manager, click on Internet Security that is currently running and do: end task, and then I can send my email.

    Could this be a clue to all this mess?
    0
    1. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
       
      Hello

      How about I leave you in the hands of an expert since I have explored all the avenues I had?

      What do you think?
      0
  12. roulio 13 Posted messages 23 Status Member
     
    Hello,

    yes, it's a Chinese puzzle! Anyway, thank you very much for trying!
    How should I proceed from here?
    0
    1. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
       
      Hello
      You are waiting patiently :)
      Otherwise, have you checked the extensions in your browsers and search engines
      For the security issue, it might be the Silverlight plugin; maybe uninstalling it could solve your problem.
      0
    2. Regis59 Posted messages 21143 Registration date   Status Security Contributor Last intervention   1 349
       
      Lili, if you could be more specific, that would be cool.
      When you say, have you looked at your browser extensions?
      Yes, that's relevant. It can slow down a browser. However, it would be helpful to indicate where it is ;-)
      0
    3. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
       
      Exactly, Regis, I need to improve; it's not quite there yet, but since you’ve taken over, a big thank you! :)
      0
  13. roulio 13 Posted messages 23 Status Member
     
    Hello,
    yes I did it in safe mode with and without network, and now MBAM goes to the end and detects nothing. However, instead of taking about 40 minutes for a scan, it finishes in less than 20 minutes.

    I don't know if it's normal for it to be faster in safe mode.
    0
  14. Regis59 Posted messages 21143 Registration date   Status Security Contributor Last intervention   1 349
     
    Sure.
    So it should block on a file in normal mode... that happens.
    If it doesn't detect anything in safe mode, that's fine. No need to do it again in normal mode.

    Download AdwCleaner (by Xplode) to your desktop.
    Run it, click on [Search] and wait for the scan to complete.
    Once the scan is finished, a report will open. Post its content in your next response.

    Note: The report is also saved under C:\AdwCleaner[R1].txt

    --
    "Impossible is nothing"
    0
  15. roulio 13 Posted messages 23 Status Member
     
    re-hello!

    here is the report:

    AdwCleaner v2.112 - Report created on 19/02/2013 at 15:46:26
    # Updated on 10/02/2013 by Xplode
    # Operating system: Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username: Julien - JULIEN-PC
    # Boot mode: Normal
    # Executed from: C:\Users\Julien\Desktop\AdwCleaner-2.112.exe
    # Option [Search]

    ***** [Services] *****

    ***** [Files / Folders] *****

    Folder Present: C:\Program Files (x86)\Agence-Exclusive
    Folder Present: C:\Program Files (x86)\Conduit
    Folder Present: C:\Program Files (x86)\v-Grabber
    Folder Present: C:\ProgramData\Ask
    Folder Present: C:\ProgramData\Babylon
    Folder Present: C:\ProgramData\InstallMate
    Folder Present: C:\ProgramData\Premium
    Folder Present: C:\Users\Julien\AppData\Local\Agence-Exclusive
    Folder Present: C:\Users\Julien\AppData\Local\Conduit
    Folder Present: C:\Users\Julien\AppData\Local\Google\Chrome\User Data\Default\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
    Folder Present: C:\Users\Julien\AppData\LocalLow\Conduit
    Folder Present: C:\Users\Julien\AppData\LocalLow\PriceGong
    Folder Present: C:\Users\Julien\AppData\Roaming\Agence-Exclusive
    Folder Present: C:\Users\Julien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber
    File Present: C:\user.js

    ***** [Registry] *****

    Key Present: HKCU\Software\Agence-Exclusive
    Key Present: HKCU\Software\AppDataLow\Software\Conduit
    Key Present: HKCU\Software\AppDataLow\Software\ConduitSearchScopes
    Key Present: HKCU\Software\AppDataLow\Software\Crossrider
    Key Present: HKCU\Software\AppDataLow\Software\PriceGong
    Key Present: HKCU\Software\AppDataLow\Software\SmartBar
    Key Present: HKCU\Software\DataMngr
    Key Present: HKCU\Software\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
    Key Present: HKCU\Software\ilivid
    Key Present: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    Key Present: HKLM\Software\Agence-Exclusive
    Key Present: HKLM\Software\Babylon
    Key Present: HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Key Present: HKLM\SOFTWARE\Classes\AppID\{759F1421-4D31-4C1F-8C51-E4956A037676}
    Key Present: HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
    Key Present: HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Key Present: HKLM\SOFTWARE\Classes\AppID\PCTutoBHO.DLL
    Key Present: HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
    Key Present: HKLM\SOFTWARE\Classes\Prod.cap
    Key Present: HKLM\Software\Conduit
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASAPI32
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASMANCS
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
    Key Present: HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
    Key Present: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
    Key Present: HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
    Key Present: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    Key Present: HKLM\SOFTWARE\DataMngr
    Key Present: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    Key Present: HKU\S-1-5-21-709892753-828266104-2070350981-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    Value Present: HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
    Value Present: HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
    Value Present: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
    Value Present: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

    ***** [Browsers] *****

    -\\ Internet Explorer v9.0.8112.16464

    [OK] The registry does not contain any illegitimate entries.

    -\\ Google Chrome v [Unable to obtain version]

    File: C:\Users\Julien\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] The file does not contain any illegitimate entries.

    *************************

    AdwCleaner[R1].txt - [4617 bytes] - [19/02/2013 15:46:26]

    ########## EOF - C:\AdwCleaner[R1].txt - [4677 bytes] ##########
    0
  16. Regis59 Posted messages 21143 Registration date   Status Security Contributor Last intervention   1 349
     
    Re,

    Can you do the delete option and put the report?

    However, be careful with what you download. When you install free software, watch out for the pre-checked boxes that install a lot of crap.
    Apparently, you have been on streaming sites, and you must have clicked on iLivid...be careful, it's useless...and it clutters up your PC ;-)

    Lili should find you a link to explain this and avoid this junk. Take 15 minutes to read to avoid this kind of stuff. A friend's advice ;-)

    --
    "Impossible is nothing"
    0
  17. roulio 13 Posted messages 23 Status Member
     
    re-hello yes I will be careful I understood the lesson
    there it is done

    # AdwCleaner v2.112 - Report created on 19/02/2013 at 15:56:16
    # Updated on 10/02/2013 by Xplode
    # Operating system: Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username: Julien - JULIEN-PC
    # Startup mode: Normal
    # Run from: C:\Users\Julien\Desktop\AdwCleaner-2.112.exe
    # Option [Removal]

    ***** [Services] *****

    ***** [Files / Folders] *****

    Folder Deleted: C:\Program Files (x86)\Agence-Exclusive
    Folder Deleted: C:\Program Files (x86)\Conduit
    Folder Deleted: C:\Program Files (x86)\v-Grabber
    Folder Deleted: C:\ProgramData\Ask
    Folder Deleted: C:\ProgramData\Babylon
    Folder Deleted: C:\ProgramData\InstallMate
    Folder Deleted: C:\ProgramData\Premium
    Folder Deleted: C:\Users\Julien\AppData\Local\Agence-Exclusive
    Folder Deleted: C:\Users\Julien\AppData\Local\Conduit
    Folder Deleted: C:\Users\Julien\AppData\Local\Google\Chrome\User Data\Default\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
    Folder Deleted: C:\Users\Julien\AppData\LocalLow\Conduit
    Folder Deleted: C:\Users\Julien\AppData\LocalLow\PriceGong
    Folder Deleted: C:\Users\Julien\AppData\Roaming\Agence-Exclusive
    Folder Deleted: C:\Users\Julien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber
    File Deleted: C:\user.js

    ***** [Registry] *****

    Key Deleted: HKCU\Software\Agence-Exclusive
    Key Deleted: HKCU\Software\AppDataLow\Software\Conduit
    Key Deleted: HKCU\Software\AppDataLow\Software\ConduitSearchScopes
    Key Deleted: HKCU\Software\AppDataLow\Software\Crossrider
    Key Deleted: HKCU\Software\AppDataLow\Software\PriceGong
    Key Deleted: HKCU\Software\AppDataLow\Software\SmartBar
    Key Deleted: HKCU\Software\DataMngr
    Key Deleted: HKCU\Software\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
    Key Deleted: HKCU\Software\ilivid
    Key Deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    Key Deleted: HKLM\Software\Agence-Exclusive
    Key Deleted: HKLM\Software\Babylon
    Key Deleted: HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Key Deleted: HKLM\SOFTWARE\Classes\AppID\{759F1421-4D31-4C1F-8C51-E4956A037676}
    Key Deleted: HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
    Key Deleted: HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Key Deleted: HKLM\SOFTWARE\Classes\AppID\PCTutoBHO.DLL
    Key Deleted: HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
    Key Deleted: HKLM\SOFTWARE\Classes\Prod.cap
    Key Deleted: HKLM\Software\Conduit
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASAPI32
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASMANCS
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
    Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
    Key Deleted: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
    Key Deleted: HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
    Key Deleted: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    Key Deleted: HKLM\SOFTWARE\DataMngr
    Key Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
    Value Deleted: HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
    Value Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
    Value Deleted: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
    Value Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

    ***** [Browsers] *****

    -\\ Internet Explorer v9.0.8112.16464

    [OK] The registry does not contain any illegitimate entries.

    -\\ Google Chrome v [Unable to obtain version]

    File: C:\Users\Julien\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] The file does not contain any illegitimate entries.

    *************************

    AdwCleaner[R1].txt - [4738 bytes] - [19/02/2013 15:46:26]
    AdwCleaner[R2].txt - [4798 bytes] - [19/02/2013 15:55:58]
    AdwCleaner[S1].txt - [4639 bytes] - [19/02/2013 15:56:16]

    ########## EOF - C:\AdwCleaner[S1].txt - [4699 bytes] ##########
    0
  18. Regis59 Posted messages 21143 Registration date   Status Security Contributor Last intervention   1 349
     
    Ok cool.
    Good thing.

    Can you check if MBAM is still blocking?
    And if your programs are crashing?
    --
    "Impossible is nothing"
    0
  19. lilidurhone Posted messages 800 Registration date   Status Security Contributor Last intervention   3 818
     
    Hello roulio

    Here is a little article to read :)
    https://forum.malekal.com/viewtopic.php?t=6173&start=

    Thanks again regis :)

    Good luck to both of you

    --
    If there is a problem, there is always a solution
    Don't forget to mark your topic as resolved :)
    0
  20. roulio 13 Posted messages 23 Status Member
     
    Re- Thank you Lili, I will look at the link

    diagnosis
    there is still a problem

    MBAM freezes at 12 minutes on the file
    C:\Users\Julien\AppData\Local\Temp\~DFE)FF632862372537.TMP
    it's not always the same, but it's always in AppData

    My Hotmail inbox always opens with a 2nd E (instead of one on top of the other) in the taskbar and is very slow to open. If I want to open a second tab, it doesn't open the first time and says IE cannot display this page

    And my Pinnacle software opens the first time and to reopen it a second time, I have to restart my computer.

    And since I uninstalled SKYPE, I can't check if it works. (that's how I discovered there was a problem.

    Thank you for your patience
    0
  21. Regis59 Posted messages 21143 Registration date   Status Security Contributor Last intervention   1 349
     
    Ok.
    Do you know how to delete temporary files?

    --
    "Impossible is nothing"
    0
  • 1
  • 2